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In tills paper, we consider continuous-variable quantum Itey distribution (QKD) protocols wiilcii 
use non-Gaussian modulations. Tliese specific modulation schemes are compatible with very efficient 
error-correction procedures, hence allowing the protocols to outperform previous protocols in terms 
of achievable range. In their simplest implementation, these protocols are secure for any linear 
quantum channels (hence against Gaussian attacks). We also show how the use of decoy states 
makes the protocols secure against arbitrary collective attacks, which Implies their unconditional 
security In the asymptotic limit. 
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The first potentially real-life application of the emerg- 
ing field of quantum information is arguably quantum 
key distribution (QKD) which allows two distant par- 
ties to establish a secret key over an a priori unsecure 
communication channel The importance of a QKD 
protocol is usually measured through three main criteria: 
its practicality, its performance and its security. 

Among all existing protocols, those based on contin- 
uous variables appear quite appealing from a practical 
point of view 01 . For instance, the protocol GG02 Q 
simply requires the preparation of coherent states and 
their detection via homodyne (or heterodyne) detection. 
Moreover, the security of this protocol is established 
against collective attacks which are optimal in the 
asymptotic limit Q- There exist different ways to quan- 
tify the performance of a given protocol, but the usual 
figure of merit is the secret key rate that can be achieved 
as a function of the distance. Continuous- variable proto- 
cols such as GG02 perform quite well for short distances, 
but seem unfortunately limited to much shorter distances 
than their discrete-variable counterparts (see Fig. 4 of 
Rcf. [l[ for a comparison of the performance of various 
protocols). In particular, while discrete- variable proto- 
cols allow one to distribute secret keys over distances 
larger than 100 km, GG02 has only be implemented for 
a distance of 25 km 0, Q and there is not much hope of 
increasing its range well beyond 50 km [lo| . 

In this paper, we introduce continuous-variable (CV) 
QKD protocols which share the practicality and security 
of GG02, but greatly improve its performance, especially 
in terms of achievable distance. 

In Section |TT1 we quickly review the status of current 
CV protocols. In Section lllll we present the specific mod- 
ulation schemes of our protocols. We then introduce the 
concept of decoy states for CV QKD protocols in Section 
IIVI In Section |Vl we prove the security of our proto- 
cols against collective attacks and we finally discuss their 



II. LIMITATIONS OF CURRENT CV 
PROTOCOLS 

Proving the security of a QKD protocol is usually a dif- 
ficult task, but the situation is even worse for continuous- 
variable QKD protocols, because the relevant Hilbcrt 
space is infinite dimensional. The task is difficult for (at 
least) one specific reason: the bipartite state pab shared 
by Alice and Bob (in the entanglement-based version of 
the protocol) has an infinite number of degrees of free- 
dom. This means that a full tomography of this state 
is hopeless, even in the case of collective attacks, where 
Alice and Bob share many copies of the same state. 

Fortunately, one can take advantage of extremality 
properties of Gaussian states [ll| to show that the eaves- 
dropper's information is upper-bounded by the informa- 
tion she would have if Alice and Bob shared instead the 
state Pab 7 the Gaussian state with the same first two 
moments as pab [l-Q- Hence, knowing the first two 
moments of the state pab, that is, a finite number of pa- 
rameters, is sufficient to bound Eve's information. Fur- 
thermore, taking advantage of specific symmetries of the 
protocols in phase-space [12l | , it is possible to reduce this 
number to only three, namely the variances of Alice and 
Bob's reduced states and the covariance. That so few 
parameters are indeed sufficient to bound Eve's informa- 
tion is quite remarkable, but it should be noted that this 
is also a necessity if one wants to take finite-size effects 
into account. Indeed, it was shown in [l^ that estimat- 
ing these parameters with a precision compatible with 
a secret key rate is already very challenging in terms of 
resources. 

Because of the constraints imposed by finite-size ef- 
fects, the only theoretical tool presently available to prove 
the security of a continuous-variable QKD protocol is 
therefore this Gaussian optimality. This technique un- 
fortunately comes at a price, namely that if the true 
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quantum state pab is not sufficiently close to a Gaussian 
state, then the bound on Eve's information will not be 
tight enough to still get secret bits at the end of the pro- 
tocol. By construction, this bound is indeed only tight 
for Gaussian states, and it turns out that it degrades very 
rapidly as the non-Gaussianity of the state (and conse- 
quently of the protocol) increases. 

This observation leads us to the unavoidable conclusion 
that with the theoretical techniques available today, pro- 
tocols using a Gaussian modulation (i.e. GG02, possibly 
with a heterodyne detection are optimal among all 
continuous-variable QKD protocols, and using any other 
modulation scheme can only lead to worse performances 

A natural question then arises: why should one con- 
sider new protocols involving specific non-Gaussian mod- 
ulations since theoretically ^ they cannot beat a Gaussian 
modulation? The reason is that, in practice, protocols 
with a Gaussian modulation do not perform as well as 
expected, especially with regards to long distance com- 
munication. This is due to the fact that error-correction 
is very hard to implement for a Gaussian modulation, 
thereby making the effective secret key rate drop to zero 
at distances of the order of 50 km, even if the theoretical 
key rate is strictly positive. 

The protocols we introduce in the present paper out- 
perform previous protocols in terms of maximal range. 
This is achieved thanks to a combination of two facts: 
first, the specific modulation schemes allow one to extract 
information much more efficiently than with a Gaussian 
modulation ; second, there is a regime (for the variance 
of the modulation) where the protocols are still signif- 
icantly close to a Gaussian protocol, hence making the 
bound on Eve's information tight enough to be useful. 



III. NEW MODULATION SCHEMES 

The main argument for switching from a Gaussian 
modulation to a non-Gaussian one is not because it might 
make the eavesdropping more difficult (available theoret- 
ical tools are not powerful enough to answer this ques- 
tion). The reason is that present coding techniques do 
not allow for a very efficient reconciliation procedure at 
(very) low Signal-to-Noise Ratio (SNR) when Alice's data 
are Gaussian. Remember that a QKD protocol typically 
consists of three phases: first, Alice and Bob exchange 
quantum signal, perform measurements and obtain cor- 
related classical data, say vectors x and y; second, in 
the reconciliation step, they use classical error correction 
techniques to agree on a common (errorless) bit string u, 
and finally, they apply privacy amplification to obtain a 
secure key from u. 

The importance of the reconciliation phase is specific 
to continuous-variable protocols for two reasons. First, 
one has to deal with continuous values for both Alice 
and Bob's variables instead of bits, which is rather un- 
usual in the field of digital communication. Indeed, even 



when analog signals are used to transmit information on 
noisy (classical) channels, the modulation is almost al- 
ways discrete and not continuous. The second reason is 
that contrary to discrete- variable QKD protocols where 
the error rate is always below some small constant (to 
guarantee the security of the protocol) , the SNR can be 
arbitrarily small for continuous- variable protocols (and is 
actually very small as one tries to increase the range of 
the protocol [s^). 

For continuous- variable QKD protocols, information is 
encoded in phase space, in general in the quadratures 
of coherent states [Sa]- More precisely, if the classical 
information she wants to send is described by a vector 
x = (.Ti,X2,--- ,X2n)^ then Alice prepares the n coher- 
ent states \xi + 1x2), • • • , |a;2,i-i + ix2n) and sends them 
through the quantum channel. 

There arc two possibilities concerning the detection: 
Bob can perform either homodyne or heterodyne mea- 
surements. In the case of a homodyne detection, for each 
state. Bob chooses randomly which quadrature to mea- 
sure. He then obtains an n-dimensional classical vector y 
and later informs Alice of his choices of quadratures. In 
the case of a heterodyne detection. Bob ends up with a 
2n-dimensional vector y. Hence, Alice and Bob share 
twice as many data for the heterodyne protocol than 
for the homodyne one. However, a heterodyne detec- 
tion adds 3 dB of noise to the data, and in practice the 
performances of both schemes arc quite similar. 

In order to complete the key distribution, two addi- 
tional steps arc required. First Alice and Bob proceed 
with the reconciliation of their classical data in order to 
agree on a common bit string u. Here, we restrict our- 
selves to a reverse reconciliation [l5| . meaning that only 
Bob can send classical information to Alice (in contrast 
to direct reconciliation where Alice would send some side- 
information to help Bob correct his errors). Second, they 
use privacy amplification in order to obtain a secret key 
from u: this can only be done once they have an upper 
bound on Eve's information about u. 

In this paper, we consider protocols for which the rec- 
onciliation can be performed efficiently (which is not the 
case of the protocols using a Gaussian modulation), and 
for which Eve's information can be bounded if she is re- 
stricted to collective attacks. Security against general at- 
tacks ("unconditional security") is then obtained in the 
asymptotic limit, thanks to a de Finetti representation 
theorem for infinite-dimensional quantum systems 

To be more specific, the protocols considered here are 
characterized as the ones for which the reverse recon- 
ciliation problem can be reduced to the channel cod- 
ing problem for the binary-input additive white Gaus- 
sian noise (BI-AWGN) channel, which can itself be tack- 
led with standard techniques (efficient error correcting 
codes) . One such protocol is the four-state protocol con- 
sidered in [T6j . but it turns out that other, more efficient, 
continuous modulation schemes are also possible. 
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A. Homodyne detection : four-state modulation B. Heterodyne detection: non-Gaussian continuous 

modulations 



Let us consider protocols involving a homodyne de- 
tection. In this case, the protocols of interest display 
a discrete modulation with either 2 or 4 states, and a 
basic problem is how to evaluate the transmission chan- 
nel, and thereby Eve's information. Such a problem does 
not arise for Gaussian modulations, because the vari- 
ances and covariances directly measured by Alice and 
Bob give a covariancc matrix, which is all that is needed 
to characterize the worst possible attack by Eve, which is 
a Gaussian attack according to the Gaussian optimality 
theorem. On the other hand, for a non-Gaussian modula- 
tion, the noises and correlations measured by Alice and 
Bob cannot be directly connected to a relevant covari- 
ance matrix, and the Gaussian optimality theorem docs 
not apply directly. 

Among possible approaches, two-state protocols were 
studied in |17| . and the authors proved the security of 



the protocols against any collective attacks, but with the 
caveat that a complete tomography of the state was re- 
quired. In 0, [13, the authors considered the noises and 
correlations measured by Alice and Bob from their non- 
Gaussian modulation, and then considered the Gaussian 
attacks associated with these values as optimal. However, 
this approach has the implicit assumption that the trans- 
mission channel can be considered as linear, which means 
that it is intrinsically characterized by a transmission T 
and an excess noise ^ (see details in Appendix K)) . Gaus- 
sian channels are obvious examples of linear channels, 
but a linear channel may also be non-Gaussian. Since 
the proofs of [l^, [l^ only involve estimating the sec- 
ond moments of Alice and Bob's correlations, they are 
compatible with a practical implementation taking into 
account finite-size effects , but they are not fully gen- 
eral. 

In the present paper, we extend the security proof of 
discrete modulation protocols against arbitrary collective 
attacks. Our proof still only requires us to estimate two 
quantities: the transmission T and excess noise ^ of the 
quantum channel, without carrying out a full channel 
tomography. But achieving this estimation requires the 
use of decoy states, as will be explained in Section ITVl 

Since the four-state protocol always outperforms the 
two-state protocol, we will only discuss the case of 
the former in the present paper. In this proto- 
col, the modulation consists of four coherent states: 
|ae*'^/4), lae^'""/^), lae-^"/^), lae""/") where a is a pos- 
itive number. The modulation variance Va is given by 
Va = 2a2. 

The practical implementation of the reverse reconcili- 
ation problem for the four-state protocol is discussed in 
details in Appendix [Bl 



Before introducing the modulation schemes compatible 
with a heterodyne detection, let us say a few words con- 
cerning the reconciliation procedure. The main difficulty 
here lies in the fact that we need a reverse reconcilia- 
tion. Indeed, the side information sent by Bob must help 
Alice without giving Eve any relevant information. The 
only schemes where side information seems to have these 
properties (while being efficiently computable by Bob) 
are when it describes rotations in particular dimensions, 
namely dimensions 1, 2, 4 and 8 [To| . This surprising 
result is a consequence of the fact that the only real di- 
vision algebras are the real numbers (]R), the complex 
numbers ((D = R^), the quaternions (H = R^) and the 
octonions ((D = R'^). Indeed, one can show that the pos- 
sibility of an efficient reconciliation protocol (in terms 
of computation complexity as well as classical commu- 
nication) is intimately connected with the existence of a 
division operation for the data considered. In particu- 
lar, identifying vectors in R, R^, R^ or R® with units of 
the real numbers, the complex numbers, the quaternions 
or the octonions allows one to take benefit of the divi- 
sion structure naturally associated with these ensembles. 
For instance, the reconciliation protocol of the four-state 
protocol exploits this property in dimension 1. The mod- 
ulation schemes we consider now exploit it for dimensions 
2, 4 and 8. 

First, note that in the case of the four-state protocol, 
Alice chooses the value of each quadrature uniformly on 
the (0-dimcnsional) sphere S'^ = {—1,1} in dimension 
1. (This value is then appropriately rescaled to obtain 
the desired variance of modulation.) For this reason, we 
will sometimes refer to the four-state protocol as the 1- 
dimensional protocol in the rest of the paper. 

The modulation schemes we consider now are simply 
the generalizations to dimensions 2, 4 and 8. Hence, 
in the d-dimensional protocol (with d G {2,4,8}), Alice 
draws random variables uniformly on the sphere S"^'^ in 
dimension d. 

For d — 2, Alice draws n points on the unit circle: 
{{x\, xl), (^2, X2), - ■ ■ , (x^, x^)}, and sends the n coher- 

?, ) , where the variables 



ent states |a;{ -I- ixf), • • • , \x^ 
are rescaled by a factor a. 

For d = 4, Alice draws n/2 points on the sphere S^: 

{{Xi,Xi,Xi,Xi), - ■ ■ I (2;„y2' ■^71/2)}' ^^'^ SCuds 

the n coherent states \x\ + ixf), jxf + ixf) 



IX. 



Si/2 



IX 



,/2. 



, where the variables are rescaled by a factor a\/2. 
For d = 8, Alice draws n/4 points on the sphere 5^: 

S f 'T'^ ™3 ™4 ^6 ™.7 ™8 \ Z™! rvi2 ^3 ^4 

■[|^X2,X]^,X]^,X2,X2,X]^,X]^,J,]^J, , [X„^^, X^^^, 

'■^n/4)}' ^^"^ sends the n coherent states 



*^n/4' '^n/4' -^n/i 

\x\ + ixl),\xl + ixf) 



X' 



where the 



1/4 ^ ''•^n/4/ 

variables are rescaled by a factor 2a. 

The procedure to reduce the reverse reconciliation 
problem in these three scenarios to the usual problem 
of channel coding for the BI-AWGN channel is explained 
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in detail in Appendix [BJ 

Let us say a few words about what we mean by efficient 
reconciliation procedure in the context of QKD. Usually 
in the field of computer science, an algorithm is said to 
be efhcient if the amount of resources {e.g. running time, 
randomness generation, classical communication, etc) it 
consumes grow at most polynomially with the natural 
size of the problem. In the case of a reconciliation pro- 
cedure, the problem size is given by the length n of the 
vectors Alice and Bob try to agree on. As n usually takes 
very large values (for instance lO^'^ or 10"'^^), an algorithm 
requiring resources scaling as or is obviously un- 
acceptable: only a linear scaling is compatible with a 
practical implementation. Moreover, the factor of pro- 
portionality should be small enough. For d = 1, 2, 4 or 8, 
the reconciliation procedure introduced in [lol | requires 
that Bob draws one random bit and transmits classically 
one real number to Alice per exchanged signal. The com- 
putational complexity of the protocol (not including the 
decoding of the error correcting code) is linear with n. 
For values of d strictly greater than 8, the naive approach 
(which consists in drawing random transformations uni- 
formly in the orthogonal group Od and transmitting them 
to Alice) requires that Bob draw d random variables from 
a normal distribution (instead of only 1 bit) and to send 
d real values to Alice for each exchanged quantum signal, 
which is prohibitive for a realistic implementation. 

It should be emphasized that the higher the dimension, 
the higher the secret key rate of the QKD protocol. The 
reason for this is the very specific technique that we use 
to bound Eve's information. Our bound depends only on 
the covariance matrix of Alice and Bob's bipartite state 
in the entanglement-based version of the protocol, and 
therefore is tight only when the state is Gaussian. Fortu- 
nately, if the state is almost Gaussian, then the bound is 
good enough for our purpose. Because of this, we want to 
use a protocol as Gaussian as possible. It turns out that 
considering modulations in higher and higher dimensions 
brings us closer and closer to the Gaussian modulation 
for which the bound is tight. Indeed, a Gaussian modu- 
lation of variance 1 can be seen as drawing uniformly a 
random point of the sphere of radius Vd in R'^ as d tends 
to infinity. Hence, the GG02 protocol with a Gaussian 
modulation can be seen as the d-dimensional protocol 
with d = oo. Unfortunately, for d ~ oo, efficient recon- 
ciliation techniques at low SNR are not known. 



IV. DECOY STATES 

As we already mentioned, it is crucial that the security 
proof of CV QKD protocols requires the estimation of 
only a few parameters. Ideally, one would like a GG02- 
type security proof where only the transmission T and 
the excess noise ^ of the quantum channel need to be 
estimated. 

As we will discuss in Section |Vl the security proof of 
our protocols indeed relics on the fact that one can esti- 



mate the covariance matrix of Alice and Bob's bipartite 
state in the entanglement-based version of the protocol. 

A difficulty lies in the fact that Alice and Bob do not 
perform the entanglement-based version of the protocol 
(in which case the covariance matrix is directly accessi- 
ble in the experiment) but use instead the prepare and 
measure version. Hence, if Alice encodes the variable x 
in the quadrature of a state and Bob obtains the result y 
when measuring this quadrature, they can estimate the 
three following moments of order 2: Alice's variance (x^), 
Bob's variance (y^) and the covariance (xy). Whereas Al- 
ice and Bob's variance in the prepare and measure sce- 
nario are directly related to the respective variances in 
the entanglement-based scenario, the same is not true for 
the covariances. 

There are two cases where the covariance matrix in the 
prepare and measure protocol allows one to recover the 
covariance matrix of the state in the entanglement-based 
scenario, namely when the quantum channel is linear (see 
Appendix E)) . for instance a Gaussian channel, and when 
the modulation is Gaussian. 

In Refs. [l^, [l^, the security of the protocols con- 
sidered in the present paper was established in the case 
of linear channels. Here, we wish to get rid of this hy- 
pothesis (which can never be perfectly verified in practice 
with a finite number of samples) , and for this reason, it 
is necessary to use a Gaussian modulation for the pa- 
rameter estimation procedure. Unfortunately, it is not a 
priori possible to use two different modulations for key 
distribution and parameter estimation, because an eaves- 
dropper could use a different strategy in each case. The 
solution is to add a third modulation consisting of decoy 
states. Let us call "key", "decoy" and "G" the modu- 
lations corresponding respectively to states used for the 
key distillation, decoy states and states used for param- 
eter estimation purposes (a Gaussian, in fact thermal, 
distribution). One can define the three following states: 

0-key = J Pkcy(a) \a){a\ da (1) 

c^decoy = J Pdccoy {a) \a){a\ da (2) 

- / PG{a)\a){a\da (3) 

where a £ Mf^ for the d-dimensional protocol. (In par- 
ticular, \a) refers here to d/2 coherent states.) In these 
expressions, the probability distribution pkoy is the uni- 
form measure of the sphere S'^^^ (with radius ay^d/2) 
and pG is the Gaussian distribution J\f{0, a^/2)^'* in d di- 
mensions. In other words, pkcy corresponds to the mod- 
ulation schemes described in Section IIIIl and pQ is the 
Gaussian distribution of the GG02 protocol. 

If the probability distribution Pdocoy is chosen such that 

P<y + (l-p)f^dccoy-og, (4) 

where p is a weight between and 1, then the state sent 
by Alice to use for parameter estimation is indistinguish- 
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able from that used to distill a key (or as a decoy). The 
idea is that after the exchange of quantum states is com- 
plete, Alice can announce to Bob which states he can 
use for the key, which states he can discard (decoys) and 
which states should be used for parameter estimation. 

If in principle, the form of crf^^^^ does not matter (it 
could be any state, not necessarily of the form [2]), this is 
no longer true if we require the protocol to be practical. 
Indeed, for this reason, we impose the extra constraint 
that o-fgf.„y should be obtained as a mixture of coherent 
states, i.e. be of the form[21 We discuss this in details in 
Appcndix[C]where we describe two techniques for finding 
the appropriate decoy states. 

To summarize, the modulation that is used in the pro- 
tocols is a mixture of three particular modulations. Let 
us note Pest the fraction of states that Alice and Bob want 
to use for parameter estimation purposes (this fraction 
can be optimized numerically but in a typical scenario, 
its value can be around 50 %). Then for each state she 
sends, Alice will choose cither the modulation Pkcy(«) 
with probability p{l — Pest) or modulation pg{q:) with 
probability pcst or send a decoy state with probability 

(1 -p)(l -Pcst)- 



V. SECURITY AGAINST COLLECTIVE 
ATTACKS 

In this paper, we restrict ourselves to the case of col- 
lective attacks since they are optimal in the asymptotic 
limit Q- The (asymptotic) secret key rate K is then 
given by : 

K^PI{A-B)~X{B\E), (5) 

where /3 is the reconciliation efficiency, /(A; B) is the clas- 
sical mutual information between Alice and Bob's data 
(for the data corresponding to the modulation pkcy('^)) 
and x{B] E) is the Holevo quantity: 

x{B-E) = S{pE)~Y.P^y)^^PE\y)^ (6) 
y 

where S is the von Neumann entropy, y is Bob's mea- 
surement result obtained with probability p(y), PE\y 
is the corresponding state of Eve's ancilla and pE = 
^yP{y)pE\y is Eve's partial state. 

Note that this rate should be modified to take finite- 
size effects into account. For simplicity, we only con- 
sider the asymptotic rate here, but a complete analysis 
of finite-size effects can be found in Ref. [1^ . 

Since the quantity I3I{A; B) is directly observable in 
practice, the goal of the security proof consists in deriving 
an upper bound for the quantity x{B]E) which should 
be a function of parameters accessible in an experiment. 
In our case, we will find a bound which only depends on 
three parameters: the variance of modulation Va which 
is chosen by Alice, the transmission T and the excess 



noise ^ of the quantum channel which can be estimated 
with the technique described in Ref. [T3| . 

We now consider the entanglement-based version of our 
protocols. In this scenario, Alice prepares n two-mode 
squeezed vacuum states, keeps one half of each state and 
sends the second half to Bob through the quantum chan- 
nel. 

Let us introduce some notations. In the following, we 
will consider bipartite states, either before or after the 
quantum channel. We use the superscript to denote 
states before the quantum channel. Moreover, the action 
of the quantum channel can be described by a map 1 ® 
T where the identity acts on the first part of the state 
(namely, Alice's state) and the quantum channel T acts 
non-trivially only on the second part of the state. 

The three states of interest are pg, (^^^ and yOjecoy 
which are the Schmidt purifications of the states Gq , a^^^ 
and CTjjj^Qy, respectively. (Note for instance that (Pq is a 
two-mode squeezed vacuum: = |EPR)(EPR|.) After 
the quantum channel, these three states become respec- 
tively PG, Pkcy and pdocoy 

The main idea of the security proof is that one can 
bound Eve's information by a function of the covariance 
matrix of the state used to distill the key: pkoy In the 
protocol, Alice always starts with a two-mode squeezed 
state but she can choose between two measurement 
strategies depending on whether a given state will be 
used for key distillation or for parameter estimation. 

We also introduce a general measurement acting on 
Alice's part {XI^, 1 — He;} such that, when applied to the 
two-mode squeezed vacuum p^, the result corresponding 
to Ilrf prepares the state pJJ^^ used in the d-dimensional 

protocol while the second result prepares p^Jccoy (s*^*^ -'^P" 
pendix|D]for a description of this measurement). 

For each state, Alice chooses randomly between key 
distillation and parameter estimation. The fraction of 
each task should be optimized taking into account all 
finite-size effects. 

If a state is dedicated to parameter estimation, Alice 
simply performs a heterodyne detection on her part and 
Bob proceeds as usual. At the end of the protocol, Alice 
and Bob can compare their statistics and compute the 
covariance matrix Vq of the state pQ. For this, we do not 
need to make any assumption (for instance of linearity) 
concerning the quantum channel. 

If a state is to be used for key distillation, then Alice 
performs the generalized measurement {11^, 1 — 11^} on 
her half of the state, thus preparing p^^^ with probability 
p and Pdecoy with probability 1 — p. States corresponding 
to the result 1 — Ltd will later be discarded. Finally, only 
the states p\^y are used for key distillation. Let us note 
^kcy (^kcy) t^c covariaucc matrix of these states before 
(after) the quantum channel. 

It was proven in Q that the quantity xkB\ E) can al- 
ways be upper bounded by a function of the covariance 
matrix of Alice and Bob's bipartite state. Here, the state 
used for key distillation is Pkoy, meaning that one can 
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bound x{B; E) with a (known) function of Fkoy (see Ref. 
Q for the precise form of this function). 

Ah that is left to do is therefore to compute the covari- 
ance matrix Fkey- Note that the covariance matrix ^'^^y 
of the state before the quantum channel can be computed 
and only depends on the modulation variance (as well as 
the dimension of the modulation scheme) . Details on how 
to compute this covariance matrix arc given in Appendix 
11 

The covariance matrix Tjjgy has the following form 
(with the convention xa,PAtXb,Pb)'- 



by Zd-. 



key 



'{Va 



l)l2 



Zd<7z 



Zd (Jz 

{Va + 1)12, 



(7) 



where az = diag(l,— 1). Here Va ~ is Alice's mod- 
ulation variance in the prepare and measure version of 
the protocol and Zd is a function of Va and the di- 
mension d of the protocol. The two-mode squeezed vac- 
uum, corresponding to a modulation on a sphere whose 
dimension tends to infinity, has the same form with 
Zoo '■= Z-EPR = \/V\ + 2Va. a comparison of Z\ (four- 
state protocol), with the maximal value ^epr is dis- 
played on Figure [T] 
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Figure 1: (Color online) Comparison of the covariance coeffi- 
cient Z for the states Pepr (top solid black curve) and p[J(,y 
for the four-state protocol (bottom short-dashed blue curve) 
and the 8-dimensional protocol (middle long-dash red curve) 
as a function of the variance of modulation Va- 

One also knows the covariance matrix Vq of the state 
Pq after the quantum channel: 



(^^1 + 1)12 



VT Zeprctz 

(i+TVA+mh 



(8) 



where T and ^ refer respectively to the transmission and 
excess noise of the channel and can be estimated experi- 
mentally [m. 

The last part of the argument consists in proving that 
the covariance matrix F^ey has the same form (or at least 
can be safely considered to have the same form) as Tq 
after the quantum channel, if one simply replaces ^epr 



key = 



_f{V^+l)h 

TZd<Jz (1 



Zd (Jz 
-TVA+T012, 



(9) 



This is clear if the quantum channel T is linear, for 
instance Gaussian but the argument is more involved in 
the case of an arbitrary quantum channel. 

In fact, if the channel is linear, Alice and Bob can 
directly compute the covariance matrix F^cy from the 
data corresponding to the modulation Pkey(a) and the 
Gaussian modulation or the decoy states are not required 
in that case [11 El. 

Because the modulation considered here is indistin- 
guishable from a Gaussian modulation, the parameter 
estimation is performed in such a way that there are no 
privileged direction in phase space. However, this is for- 
mally not enough to warrant that Eve's attack has the 
same symmetry. We therefore provide the following two 
strategies: either one assumes that the symmetry is not 
broken by Eve (which in theory could be checked by per- 
forming a tomography of the state), or one docs not want 
to make such an assumption and prefers to actively sym- 
metrize the protocol. 

In the first scenario, under the assumption that the 
symmetry of the quantum channel is not broken, the se- 
curity protocol with decoy states presented here is at least 
as good as in the case where the channel is linear. Indeed 
the quantum state shared by Alice and Bob is invariant 
under the group of conjugate passive symplectic oper- 
ations applied on Alice's n modes and Bob's n modes, 
which means that their state can be safely considered 
to be Gaussian if the analysis is restricted to collective 
attacks Q. 

However, if one does not want to rely of the assumption 
that the symmetry is not broken, it is possible to remove 
this assumption thanks to an active symmetrization of 
the protocol. This is described in detail in Appendixes iFl 
and[Ul This additional step shows that the state pa after 
the quantum channel is rotationally invariant in phase 
space. Therefore, when restricting ourselves to collective 
attacks, we conclude using the technique presented in 
Ref. 13 that the state pc can be safely considered to 
be Gaussian. In particular, the covariance matrix given 
in Eq. IH] can be used for the security analysis, with the 
same values of T and ^ as the ones in Tq, obtained from 
the parameter estimation step. 

Finally, using the covariance matrix F^ey , one can com- 
pute the quantity x{B] E) using for instance the formal- 
ism detailed in Isl . 



VI. PERFORMANCE OF THE PROTOCOLS 

The (asymptotic) secret key rate of the protocols reads: 

K = pI{A;B)-xiB;E). (10) 

The idea in our protocols is to use a modulation scheme 
which is compatible with a very efficient reconciliation, 
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thereby greatly increasing the quantity f3I{A; B) in com- 
parison with Gaussian modulation protocols. 

The price to pay is that this non Gaussianity makes 
our bound on E) less tight. This is because the cor- 
relation Zd of the state p^^^^ is strictly less than Zepr 
for a given variance of modulation. Interestingly, this 
discrepancy can be interpreted in terms of excess noise: 
the fact that p^^^ displays smaller correlations than the 
two-mode squeezed state has the same effect as some vir- 
tual excess noise. In particular, the value of x{B] E) 
one obtains in the d-dimensional protocol corresponds 
to the value one would obtain for a Gaussian modula- 
tion protocol (GG02) with a quantum channel charac- 
terized by a transmission Tg = T/F w T, and an excess 
noise = + {F - 1)Va ^ ^ + {F - 1)Va, where 
F = {Zepk/Zci)'^ ■ Since one has F « 1 for reason- 
able values of Va (see Figure [T]), the main effect of the 
non-Gaussian modulation is the equivalent excess noise 
— {F ~1)Va- Figured] displays this equivalent excess 
noise in the case of the four-state protocol {d — 1) and 
the 8-dimensional protocol. 




0.0 0.5 1.0 1.5 2.0 

Figure 2: (Color online) Equivalent excess noise due to 
the non-Gaussian modulation as a function of the variance 
of modulation Va- Upper curve refers to the four-state pro- 
tocol, lower curve to the 8-dimensional protocol. By defini- 
tion, a protocol with a Gaussian modulation does not display 
any equivalent excess noise. An excess noise of one unit of 
shot noise corresponds to an entanglement-breaking channel, 
therefore no security is possible with such a level of noise. This 
figure clearly shows that the 8-dimensional protocol outper- 
forms significantly the four-state protocol. 

In state-of-the-art implementations 0, the excess 
noise is typically less than a few percent of the shot noise. 
This gives an approximate limit for the value of the equiv- 
alent excess noise that is acceptable. In particular, for 
the four-state protocol, one needs to work with modu- 
lation variances below 0.5 units of shot noise. On the 
contrary, it becomes possible to work with much higher 
variances in the case of 8-dimensional protocol. 

In Fig. O we display the asymptotic secret key rate of 
the four-state and the 8-dimensional protocols. The vari- 
ous parameters are chosen conservatively: a quantum ef- 



ficiency of 60%, a reconciliation efhciency of 80% and an 
excess noise of 0.005 or 0.01 units of shot noise. The su- 
periority of the 8-dimensional protocol is quite clear: the 
secret key rate is higher by nearly an order of magnitude, 
and one can work with significantly larger modulation 
variances (the optimized variances are Va ~ 0.3 for the 
four-state protocol and Va — 0.7 for the 8-dimensional 
protocol). 



0.1 r 




distance [km] 

Figure 3: (Color online) Asymptotic secret key rate K for 
the 8-dimensional protocol (solid lines) and the four-state 
protocol (dashed lines) as a function of the distance (assum- 
ing transmission through a standard telecommunications fiber 
with 0.2 dB of loss per kilometer). The various parameters 
are an excess noise of 0.005 (upper red lines) or 0.01 (lower 
blue lines) and a quantum efliciency of the detectors 77 of 60%. 
Reconciliation efliciency is supposed to be a conservative 80%. 

To confirm the robustness of the 8-dimensional pro- 
tocol, we display in Fig. |4] the secret key rate when 
finite-size effects are taken into account. The secret key 
rate is computed against collective attacks, as detailed in 
Ref. [3l ■ Among various finite-size effects [l^l , the most 
crucial ones for continuous-variable protocols are clearly 
the imperfect reconciliation efficiency (which prevents the 
protocol with a Gaussian modulation to achieve key dis- 
tribution over large distances) and the parameter estima- 
tion. While the reconciliation efficiency is taken care of 
by the 8-dimensional continuous modulation, the param- 
eter estimation is quite sensitive for continuous-variable 
protocols. In fact, the real problem lies in the estimation 
of the excess noise ^, which is very small compared to the 
shot noise, and thus hard to evaluate accurately. 

In Fig. m all such finite-size effects are taken into ac- 
count |13| . The results are rather pessimistic, but remem- 
ber that this is also true for all discrete- variable protocols 
[23I I , and the protocols presented here perform reasonably 
well in comparison. While exchanging 10^^ quantum sig- 
nals is rather unrealistic, exchanging 10^° or even 10^"'^ 
signals is not completely out of reach of today's technol- 
ogy. Hence, our protocols allow the distribution of secret 
keys over distances of the order of 100 km, taking into 
account all finite-size effects. 
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0.1 r 




distance [km] 

Figure 4: (Color online) Non-asymptotic secret key rate K for 
the 8-dimensional protocol, obtained for realistic values: ex- 
cess noise ^ = 0.005, security parameter e ^ 10"^", quantum 
efficiency of the detectors 77 = 60%, reconciliation efficiency 
80% for the BI-AWGN channel and transmission through a 
telecommunications fiber with 0.2 dB of loss per kilometer. 
Half the samples are used for parameter estimation. From 
left to right, the block length is equal to 10*, 10^°, 10^^ and 



VII. CONCLUSION AND PERSPECTIVES 

In conclusion, we introduced continuous-variable QKD 
protocols with non-Gaussian modulations. We estab- 
lished the security of these protocols against arbitrary 
collective attacks, which implies their unconditional se- 
curity in the asymptotic limit. 

The four-state (the 8-dimensional) protocol appears 
optimal from a practical point of view among all pro- 
tocols using a homodyne (heterodyne) detection in the 
sense that it allows an efficient reconciliation while re- 
maining as close as possible to the theoretically optimal 



Gaussian protocols 0, [13] • 

The main open questions concern the status of the 
decoy states. First, it should be possible to prove the 
security of the protocols considered here without requir- 
ing any decoy states. This might come at the price of 
slightly degraded bounds (to take into account possi- 
ble non Gaussian attacks). Second, without removing 
the decoy states, an important question is how well they 
should approximate the Gaussian distribution. Put oth- 
erwise, how indistinguishable should the distribution cor- 
responding to key distillation be from the one used for 
parameter estimation? In particular, how should this 
distinguishability be taken into account in the overall se- 
curity parameter of the protocol? 

Finally, the most outstanding problem that remains 
for continuous-variable QKD protocol concerns general 
attacks. This question was partially answered with the 
derivation of a de Finetti-type theorem for quantum sys- 
tems of infinite dimension Q. However, the bounds ob- 
tained there are not good enough to be used in prac- 
tice. Hence, it seems crucial to see if the post-selection 
technique introduced in [23| can be adapted to contin- 
uous variables, since this technique is already known to 
provide much better (almost tight) bounds than the de 
Finetti theorem in the case of discrete variables [23. 
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Appendix A: Linear quantum channels 

We shall define a linear quantum channel by the input- 
output relations of the quadrature operators in Heisen- 
berg representation : 

Xout = gxXin + Bx 
Pout^ gpPin + Bp (Al) 



where the added noises Bx , Bp are uncorrelated with the 
input quadratures Xi„, Pin- Such relations have been 
extensively used for instance in the context of Quan- 
tum Non-Demolition (QND) measurements of continu- 
ous variables [1^, and they are closely related to the 
linearized approximation commonly used in quantum 
optics. Gaussian channels (channels that preserve the 
Gaussianity of the states) are usual examples of linear 
quantum channels. However, linear quantum channels 
may also be non-Gaussian, this will be the case for in- 
stance if the added noises Bx, Bp are non-Gaussian. 

For our purpose, the main advantage of a linear quan- 
tum channel is that it will be characterized by transmis- 
sion coefficients Tx = g\, Tp ~ gp, and by the vari- 
ances of the added noises Bx and Bp. These quantities 
can be determined even if the modulation used by Al- 
ice is non-Gaussian, with the same measured values as 
when the modulation is Gaussian (because these values 
are intrinsic properties of the channel). The relevant co- 
variance matrix can then be easily determined, and Eve's 
information can be bounded by using the Gaussian op- 
timality theorem. This justifies the approach taken in 
refs. [3, [I^l, but unfortunately this is not fully general, 
contrary to the proof of the present paper. 



Appendix B: Efficient reverse reconciliation 

The goal of this section is to explain how an efiicient 
reconciliation can be achieved for the various modula- 
tion schemes considered in this article, for arbitrarily low 
SNR. 

Reconciliation in a QKD protocol is very similar to the 
problem of channel coding (that is, transmitting infor- 
mation efficiently and reliably on a noisy communication 
channel) with the additional constraint that the input of 
the channel is not chosen by Alice but instead randomly 
picked from a given probability distribution correspond- 
ing to the modulation scheme. In particular, the usual 
task is the following: Alice and Bob are given two n- 
dimensional real vectors x and y and their goal is to agree 
on a common bit string u. A supplementary constraint 
when dealing with reverse reconciliation is that u should 
be a function (possibly randomized) of y, and that all 
public communication should be from Bob to Alice. 

There exists a standard technique for reducing the 
problem of reconciliation to the one of channel coding, 
namely coset coding introduced by Wyner [13] ■ The idea 
is that Bob will use an additional public (but authenti- 
cated) channel to describe a function / such /(y) = u. 
Alice can then apply this function to her vector and ob- 
tain V := /(x). In the case of coset coding, the descrip- 
tion of / is simply a translation corresponding to the 
syndrome of y for a linear error correcting code C. This 
gives rise to a virtual communication channel with input 
u and output v for which one can apply standard channel 
coding techniques. 

One case where reconciliation can be performed very 
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efficiently occurs when the virtual channel is a binary- 
input additive white Gaussian noise (BI-AWGN) chan- 
nel meaning that the coordinates of u and v are related 
through 

= u, + Wi, (Bl) 

where m G { — 1,1} and Wi is a centered normal random 
variable. 

For experimental realizations of continuous-variable 
QKD, the quantum channel always behaves in very 
good approximation like a Gaussian channel and the BI- 
AWGN channel is therefore the model of interest here. In 
this case, it is possible to show that the existence of an 
efficiently computable function / is possible only for very 
specific modulation schemes, namely the cases where d- 
uplets of distributed uniformly on the unit sphere 

in dimension 1, 2, 4 or 8 (T^]. The case d = 1 corre- 
sponds to a binary modulation, that is, the four-state 
protocol (which indeed displays a binary modulation for 
each quadrature) ; the case d — 8 corresponds to the 
8-dimensional modulation. 

Let us therefore consider d-uplcts x** and y**, with 
x'* ~ li{S'^-^) and y'^ = x'l + z'^ with z'^ ~ 7V(0, a^^. 
Without loss of generality, we restrict our attention to 
the case where the transmission is 1. 

For dimensions 1. 2, 4 and 8, the unit sphere S'^~^ 
has a division algebra. In particular, a d-dimensional 
vector can be identified with an element of R'*, that is, 
a real number {d = 1), a complex number (d = 2), a 
quaternion (d = 4) or an octonion (d ~ 8). Therefore, 
both multiplication and division are well defined in this 
context. 

Bob chooses a random element u'^ e { — l/-\/d, l/\Ai}'^ 
with the uniform distribution on the d-dimensional hy- 
percube and sends the variable := u'^y'* to Al- 
ice (through the classical channel). Alice computes 

v'* := t*^ (x'*) ^ which is possible because iS''"^ is a di- 
vision algebra. We now wish to prove that the channel 
yd ^ ^ yd _^ ^d jg ^ BI-AWGN channel. Let us 
characterize the noise w*^ on this virtual channel: 



w'* = v'^-u'^ (B2) 

= {x'^y^ - u'^ (B3) 

= u'^y'^ {x'^y^ -u'^ (B4) 

= u<i(y'i(xd)-'-l) (B5) 

= u'i((x'i + z'i)(x'^)"'-l) (B6) 

= u'^z'^ (x'^)"^ (B7) 



Since u'* and (x*^) are simply rotations on S'^ ^, one 
concludes that w** ~ A/'(0, cr^)®'', which proves that the 
virtual channel u"^ — )- v*^ is indeed a BI-AWGN channel, 
for which efficient error correcting codes are available. 

li n = d X m, Alice and Bob simply divide their data 
into m d-uplets and proceed as described above. All is 



left to do is to use coset coding to finish the reconcili- 
ation: Bob sends the syndrome of u" for a linear code 
Alice and he agreed on beforehand. Alice simply decodes 
her word v" in the coset code defined by the syndrome. 
This can be done very efficiently with capacity approach- 
ing codes such as low-density parity-check (LDPC) codes 
[28|. If the SNR is very low, then one can work with a 
concatenation of a low rate LDPC code (such as a multi- 
edge LDPC code for instance [1^) with a repetition code. 
This simple technique allows one to obtain good error 
correcting codes of arbitrarily low rate (see Chapter 5.2 
of Ref. |30| for more details concerning this concatena- 
tion technique). 

Appendix C: Decoys with coherent states 

In the entanglement-based version of the protocol, one 
has to apply the generalized measurements {11^, 1 — 11^}. 
In the prepare and measure scenario, it is therefore nec- 
essary for Alice to send states which are compatible with 
these measurements. The states corresponding to the 
operator lid arc not a problem, since by construction, 
they correspond to the modulation used to distill the key, 
that is, coherent states drawn uniformly on the sphere in 
d dimensions. The states corresponding to the opera- 
tor 1 — Ilrf might be a little bit more problematic in the 
sense that they are not usually easy to produce experi- 
mentally. Ideally, one would like to be able to produce 
these states simply by modulating coherent states (which 
are the only states simple enough to allow for a realistic 
QKD protocol). In particular, if Alice applies the mea- 
surements {lid, 1 — He;}, then one obtains the following 
relation: 

4=P<y + (l-p)'^decoy, (CI) 

with p = p^J^^'^. However, in this case, the state crf^^oy 
does not have a positive P-function, meaning that it can- 
not be obtained as a mixture of coherent states. 

We now present two different techniques to deal with 
this problem: either one replaces u^gy with a noisy ver- 
sion (sec Appendix I C ip or one relaxes Eg nation I C 1 1 and 
considers instead an approximate version of the decoy 
states (see Appendix IC 2[) . 

1. Perfect decoys with noisy signal 

Let us consider the prepare and measure version of 
the d-dimensional protocol. In this case, the Gaussian 
modulation can be seen as sending d/2 coherent states 
\ai + ia2), • • • , \ad-i + iotd) such that the random vari- 
ables ai are independent and identically distributed cen- 
tered normal variables. Without loss of generality, we 
consider variables with variance 1/d. Taking advan- 
tage of the rotational invariance of the Gaussian distri- 
bution, one can equivalently choose the random vector 
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a := (ai,--- , Ofd) by first picking uniformly a random 
point of the unit sphere S'^^^ in d dimensions, and draw- 
ing the radius r \/'}2 of tlie vector a from a chi 
distribution with d degrees of freedom. In particular, the 
probability density function of r is; 



f{r,d) = 



2{d/2) 



^72 d-l 



(rf/2-1)! 



(C2) 



The probability distributions corresponding to d = 1,2,4 
and 8 are displayed on Figure O In particular, it should 
be noted that they become more and more peaked as the 
dimension d increases. In this picture, the probability 
distribution corresponding to the key, that is cr^^y, is by 
construction a Dirac distribution centered in 1. 




Figure 5: (Color online) Probability density functions for the 
radius of a in the c?-dimensional protocol for a Gaussian mod- 
ulation. From least peaked to most peaked, d = 1,2,4 and 



The first approach we investigate aims at satisfying 
Equation ICll exactly while allowing for a positive (and 
non-negligible) probability p of sending a signal state. 
This is done by considering slightly noisy versions of the 
true signal modulation. 

In particular, one chooses two parameters 7niin G [0, 1] 
and 7max ^ 1 and defines the states used for key distil- 
lation as the ones with a radius bounded by these two 
parameters: 7inin f ^ 7max- The decoy states then 
simply correspond to the remaining states. Provided that 
7niin and 7niax are close enough to 1 , the penalty imposed 
by this noise, compared to the ideal case where the key 
modulation is strictly equal to 1, is negligible in terms of 
reconciliation efficiency. 

On the other hand, one should not choose values too 
close to 1, otherwise the probability p that a given state 
can be used for key distillation will be very small: 



P 



f{r, d) dr. 



(C3) 



Hence, optimizing the values of 7niin and 7max should 
be seen as a tradeoff between the penalty imposed on 
reconciliation efficiency and the probability that a given 
state can be used for key distillation. 



Note also that with this approach, the state a^^y is not 
longer described as in Appendix [E] In particular, the 
covariance matrix of the new state is a little bit different 
from the one presented in Appendix [E] We do not give 
an explicit derivation of the new covariance matrix here, 
but we point out that because the new state used for 
the key is actually closer to a Gaussian modulation, the 
Holcvo information between Bob and Eve can still be 
safely bounded using the covariance matrix given in Eq. 

m 

We now give a second approach to the problem of ap- 
proximating decoy states with coherent states. 



2. Approximate decoys with noiseless signal 



Our goal is still to achieve the following equality: 



PCTkoy + (1 -P) C^dccoy: 



(C4) 



but this time, without considering a noisy version of 



^kcy ■ If o^*^ chooses p — p2' 
then the state <jf^^^y does not have a positive P-function, 
meaning that it cannot be obtained as a mixture of co- 
herent states. Fortunately, P-functions can be regular- 
ized rather well, and for our purpose, it is sufficient to 
find a state <jf^ with a non negative P-function such 



as defined in Appendix iDl 



that Equation IC4I only holds approximately. Here, ap- 
proximately should be understood in terms of the trace 
distance. 

More precisely, we are interested in finding a probabil- 
ity distribution (hence non negative) P(a) such that 

lkS-P<y-(l-p) J P{a)\a){a\da\\i<e (C5) 

for a value of e sufficiently small. 

If Eq. IC5I holds and Alice uses the modulation P(a) 
for the decoy states, then the probability that Eve can 
distinguish the states used for key distillation from the 
ones used for parameter estimation is upper bounded by 
e. 

Here, we do not give a solution for the problem of 
finding the best distribution P compatible with a success 
probability p and the error e, but we point out that the 
usual optimization tools (for instance the optimization 
toolbox of Matlab) allow one to find very good instances 
of P. For example, for the 2-dimensional protocol and 
a ~ 0.5, we could obtain a value of e less than 10"'"' for 
p = 1/2 with a distribution P corresponding to a sum 
of 6 Dirac distributions, that is a mixture of 6 particular 
coherent states. 

The natural question that arises here is how good 
should the approximation be? Is a trace distance equal 
to 10~^ sufficient to guarantee a reasonable level of secu- 
rity? Or should one aim for a value of 10~^°? 

Note that if the approximation is not perfect, it means 
that Eve might have a (very) small probability to distin- 
guish between the states used for the key distillation and 
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d 


Protocol 


Resource state 


1 


4-state 


|EPR) 


2 


2-dim 


|EPR) 


4 


4-dim 


|EPR>®2 


8 


8-dim 


|EPR>®^ 



Let us consider the state Pq := |EPR)(EPR| with 



Table I: Parameterization of the various protocols. Parameter 
d corresponds to the number of quadratures that should be 
processed together. 



those used for parameter estimation. However, discrim- 
inating between these two modulations does not appear 
to be a good solution for Eve as this would induce a lot 
of phase noise in the signal: indeed, because all the mod- 
ulations considered here arc phase-invariant, the optimal 
discrimination procedure consists in projecting the states 
onto Fock states, thereby erasing all the phase informa- 
tion. For this reason, a trace distance of 10~^ between 
Pdccoy and its approximation is very likely to be sufficient 
for any practical implementation. 



Appendix D: Measurement operator 

We now describe the general measurement {n^, 1 — 
lie;} performed by Alice to prepare the state p^^^ from 
a two-mode squeezed vacuum. The state to which this 
measurement is applied is a (possibly multimodal) two- 
mode squeezed vacuum as described in Table [Pl 



a. Four-state protocol: d = 1 
The operator Hi is defined as IIi = mIMi with 



Ml = TOl ^ \ipk){ 



ek 



fe=0 



and 



,(l+a=)/2 



nil 



Ll + a2J! 



2 Y(l + a2)LiWJ- 
The states \ipk) are defined in Appendix lEl and 



(Dl) 



(D2) 



(D3) 



with P = and Arg(/3fe) = Arg(afc). 

When performing the general measurement {IIi,! — 
Hi}, conditioned on the result corresponding to Hi, the 
state p is transformed into p': 



MipMl 
tr Ml p Ml ' 



(D4) 



|EPR)=Ey (i + ^2)„-n l")l")- (D5) 



Conditioned on the result Hi, one obtains 

4. _ 4m^e-("'+i) 



MiPgMI 



.vJ/iXvfil (D6) 
+ 1 



with 



The condition 11 < 1 leads to mi < m™^^ with 



2 V (l-ha2)Li+"^J 



(D7) 



(D8) 



The probability of obtaining the result corresponding 
to Hi, meaning successfully creating a state \'^i) is 

pf'^^ = UMipM] = , ^ (D9) 

and is displayed on Figure [5] as a function of a. 



b. Continuous modulations: d = 2, 4, 8 
For d = 2,4, 8, one has: 

oo 

= E Vf^Mt) (Dio) 

where 



fc=0 



2 n^ri^^ 

/n(fc)-e-""^^ (Dll) 

and 

■■= \k)\k) 

1 ^ 

:= —=Y.\ki,k-ki)\ki,k-ki) 

iV'fc) := E l^i^i' ^2,^3,^4)1^1,^2,^3,^4) 

( 3 ) fe.=fc 



One also has: 



|EPR) = £v/^|^^) 

00 



A;=0 
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with 



n + fc — 1\ a 



„2fe 



(D12) 



k y(l + a2)n+fc- 

gn is a negative binomial distribution NB ^d, j^"^^ ^ . Let 
us define the operators 112 , 114 and Ilg as 



fe=0 



where tt^ is given by: 



TTdia) = min 



9ik) 



fcGN f{k) 



(D13) 



(D14) 



ensuring that 11^ is a genuine POVM clement. It is 
straightforward to check that the probability of success 
of the measurement is 



Pd 



f{\a^d^y 



(D15) 




Figure 6: (Color online) Probability of success of the measure- 
ment Ilti as a function of a. From bottom to top, d — 1, 2, 4 
and 8. 



Appendix E: Covariance matrices 

In this appendix, we derive the covariance matrices 
of the states corresponding to the four-state protocol, 
which is optimal with a homodyne detection, and the 8- 
dimensional protocol which is optimal for a heterodyne 
detection. The covariance matrices corresponding to the 
other (suboptimal) choices of modulation can be found 
with a similar technique. 

Let us note \'^d) for d G {1,2,4,8} the state used for 
the key distillation in each protocol, i.e. p^^^ — \'iid){'i'd\ 
and I'I'i) is the initial bipartite state for the four-state 
protocol whereas j^'g) corresponds to the 8-dimensional 
protocol. The two-mode squeezed vacuum is noted as 



|EPR). 



1. Four-state protocol: d — 1 

Let us use the notation \ak) :— |ae(2'^+^^*'^/'*) for k g 
{0,1,2,3} and a > 0. 

In the four-state protocol, the state p^^^ is a pure state 
l^"!) defined as 



fe=0 



k=0 



where 



\<f>k) 



72 



y^{4n + ky. 



1 ^ 



+2fc)m7r/4| 



(El) 
(E2) 

\An + k) (E3) 
(E4) 



m=0 

for k € {0, 1,2,3} and 



Ao 2 = 56 (cosh(a2) ± cos(a2)) , . 



(sinh(Q;2) ± sin(Q;2)) 



Let us note a and b the annihilation operators on the 
two modes. Applying a to gives: 



a\4)k) = a — ^^|0fc_i) 



for k e {1,2,3} and 



(E6) 



(E7) 



Let us compute the covariance matrix Pi of the bipar- 
tite state l^*!). It has the following form: 



Pi = 



XI2 Zia, 



(E8) 



One has: 

X = Y = (*i|l + 2a'fa|^'i) = (*i|l -|-26'f6|'I'iXE9) 
3 

= tr(l + 2^ata Afc|0fc)(0fc|) (ElO) 



fc=0 



l + 2^Afe(0fc|ata|</)fc) 



k=0 



1 -f- 2a^. 



(Ell) 

(E12) 
(E13) 
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The correlation term Z\ of the covariance matrix is 
given by 



= 27^e(1'l|a6|^'l). 



One has: 



(E14) 
(E15) 



(E16) 



fc=0 
3 



^%iVA.|0fc-i)|0.-i) (E17) 



fc=0 



A. 



where addition should be understood modulo 4. Finally, 
we obtain: 



3 ^3/2 



fe=o 



(E18) 



It may be noticed that at the lowest order in a, the 
states \4>k) are simply the number states for fc = 0, 
1, 2, 3, which are independent of a. The states arc 
four orthogonal linear combinations of these four number 
states, with coefficients of the form e^v^l^ ^ where p is an 
integer. 

In addition, the state l^*!) is simply (1 - a^/2)|00) + 
a^|ll), which is also the lowest-order (Gaussian) EPR 
state. Correspondingly, Z\ = Zepr = 2a = ^/2Va, in 
the limit where a tends to 0. 

Since the entangled state is already Gaussian in this 
regime, no decoy states are needed, and Ref. [l^ can be 
used directly to establish the unconditional security of 
the protocol. Unfortunately, this approach is restricted 
to values of a which are too small to be useful in prac- 
tice; this is why the more powerful proof presented in the 
present paper is needed. 



2. Eight-dimensional protocol: d = 8 

The partial trace cr^^y = tr^ (|5'8)(*8|) is defined by 
the modulation scheme: it is the uniform mixture of 
quadrimodal coherent states over a real 7-dimcnsional 
sphere: 

tr^ (l^sX^sl) / |ai,a2,a3,a4)(ai,Q!2,Q;3,a4|dS' 

(E19) 

where |ai, a2, 03, ck4) ■— |q;i) |q;2) |a3) |q!4) and the sphere 
Sa is defined as 

Sa = {(ai, a2, aa, 0:4) e C* 

s.t.|Q!4fep -I- |Q;4fc+iP + |a4fe+2p + |a4fc+3p = 4a^}, 

(E20) 

and dS is the Haar measure on Sa ■ Because this state is a 
four-mode orthogonally invariant state (by construction). 



it can be written as |3i| : 

00 

tr^(|vI/8)(vI/8|) = ^Afeat 

where 



(E21) 



k=0 



1 



\ki,k2,k3,k4){ki,k2,k3,k4\- 



s.t. ki—k 



(E22) 

In order to determine the {\k\k=o,- - ,00, we compute the 
probability Pr(fc) of finding k photons in the four-mode 
state tr^ (|4'8)(*8|): 

Pr(fc) = tr(tr^(|*8)(*8|)af) (E23) 
= (2a|(0|(0|(0k,4|2a)|0)|0)|0), (E24) 

since |2a) |0) |0) |0) G ^4. Because the coherent state |0), 
which refers to the vacuum, does not contain any photon, 
one has: 



Pr(fc) ^ {2a\at\2a) 



= e 

Wc therefore get the expression: 

00 

k=0 

Finally j^'s) is defined as: 



kl 



(2a) 



2k 



k\ 



1*8) :-e- 



E 

fe=0 



{2af 



(E25) 

(E26) 
(E27) 

(E28) 
(E29) 



where 



li/'fc) = \ki,k2,k:i,ki)\ki,k2,kz,ki). 



S.t. Y2,i ki—k 



(E30) 

Let us compute the covariance matrix Fg of \'^s)- It 
has the form 



r8=e 



XI2 Zsa, 
Zs<Jz XI2 



(E31) 



where 



X = (*8|l + 24ai|*8) = (*8|l + 26l6i|«'8XE32) 

Zs = (*8|aifoi + 44l*8) (E33) 

where ai and bi refer to Alice and Bob's annihilation 
operators relative to the first mode. 

Tracing \ip^) over the last three modes gives p].: 



pI 



1 

(k+3\ E 
V 3 / Z=0 



k~l + 2 



\l,l){lj\ 



(E34) 
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One immediately has: 

(*8|aIa,|*s) = ^^;('-^+')=^. (E35) 
Then, 

tr(atai/) = (E36) 

fc=0 

= a^, (E37) 
which gives X = 1 + 2a^ . 

Let us now compute Zg = {^g,\aibi+a\h\\^s). First, one 
notes that {(j)'f\aibi\'4>\) = except ii I ^ k — I. Some 
combinatorics shows that 

k 

= ^^Jk{k + i). (E39) 
Using the expression of l^'s), one obtains 

{MaM^.) - ie-^"^ f: ^^(2a)2''^+i, (E40) 

fc=0 

and finally 

Zs = le-'-'f:^^{2ar^\ (E41) 



Appendix F: Symmetrization of the protocol 

A quantum key distribution protocol is described as a 
map £ HI: 

£:Pab^{Sa,Sb,C) (F1) 

where pab G {'Ha^'Hb)®" is the n-mode bipartite state 
shared by Alice and Bob at the end of the distribution 
phase (in the entanglement-based protocol), Sa and Sb 
are respectively Alice and Bob's final keys and C is a 
transcript of all classical communication as well as Alice's 
and Bob's raw data. 

A protocol £ is said to be invariant under some set of 
transformations Q if for any element g € G, there exists 
a CPTP map ICg such that: 

£og = ICgo£. (F2) 

Let us consider the uniform measure fig on Q. If the 
protocol £ is invariant under the set G^ then it is sufficient 
to prove the security of £ for states displaying the same 
symmetry. In particular, it is sufficient to consider states 
of the form: 

PAB^ — ^ / dp.g{g)g{pAB), (F3) 



for any pab S CHa ^V-b)®^ and where g{pAB) is the 
image of the mode state pab by g. 

If we consider here for Q the group of conjugate pas- 
sive symplectic operations applied on Alice's n modes 
and Bob's n modes (in phase space, such operations are 
simply conjugate orthogonal transformations), then for a 
given operation g applied to the state, the map K,g is ob- 
tained by applying the orthogonal transformations corre- 
sponding to g on the classical data measured by Alice and 
Bob. If the protocol is invariant under this whole group, 
then it is sufficient to look at Gaussian states to prove 
security against collective attacks @ . In the prepare and 
measure version of the protocol, this group becomes the 
orthogonal group 0(2n). 

One simple way to ensure that a protocol is indeed 
invariant under a set Q of transformations is for Alice 
and Bob to actively apply random transformations of Q 
to their states. 

In particular, if Alice and Bob both apply random or- 
thogonal transformations to their classical vectors in the 
prepare and measure protocol, then the security analysis 
can be done assuming that they share a Gaussian state 
in the entangled version of the protocol. 

For our security proof, the goal of the symmetrization 
is to make sure that the state shared by Alice and Bob 
is as isotropic as possible. Indeed, remember that we 
need to estimate the covariance matrix of the state shared 
by Alice and Bob after Alice's generalized measurement 
{Ltji, 1 — lie;}. The only problem that could potentially 
happen would be that Eve guesses which states might be 
used for key distillation and which ones might be used for 
parameter estimation and that she manages to somehow 
play with Alice and Bob's correlations in order to fool 
them into overestimating their correlations. To totally 
prevent such a (quite unrealistic) scenario, it is sufficient 
to symmetrize the state so that there are no privileged 
directions in phase space that Eve could exploit. Hence, 
in practice, the symmetrization does not require to apply 
random conjugate passive symplectic operations chosen 
with the uniform measure over the whole set of such op- 
erations: a smaller subset should be efficient. A very con- 
servative quantitative criterium to evaluate the quality of 
such a set would be for instance the distance between the 
partial trace of Pab once we trace out n — \ modes and 
the Gaussian state with the same first two moments. 



1. Active symmetrization 

To make sure that the protocol is indeed invariant un- 
der specific transformations, we apply an active sym- 
metrization step to the state pab before applying the 
protocol. The transformations we consider are conju- 
gate passive symplectic operations applied on Alice's n 
modes and Bob's n modes, which therefore correspond to 
orthogonal transformations applied to their classical vec- 
tors in the prepare and measure protocol. For simplicity, 
we restrict the discussion to this prepare and measure 
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scheme in the fohowing. 

The active symmetrization requires us to choose a sub- 
set T of the orthogonal group and for AUce and Bob, and 
to apply the same element f € (chosen uniformly at 
random) to their data before starting the postprocessing. 
As we stressed above, taking for T the whole orthogonal 
group is not necessary in practice. Hence, we want J- 
to be a subset of the orthogonal group with the follow- 
ing properties: drawing a random element / from the 
uniform measure on should be doable with resources 
(time and alea generation) scaling at most linearily in n, 
the description of / should also be at most linear in n and 
applying / (or /~^) to a random vector of R" should also 
be at most linear in n. These conditions ensure that the 
protocol with the active symmetrization remains practi- 
cal. Moreover, the symmetrization should work as well 
as possible, meaning that J- should symmetrize the state 
as much as possible. 

We give examples of such possible subsets in the 
next subsection. 

2. Construction of practical symmetrizations 

Let us describe a recursive algorithm that allows one to 
draw an orthogonal transformation with the Haar mea- 
sure on 0{n). 

If we assume that we already drew a random transfor- 
mation Rn-i from the Haar measure on 0{n — 1), then 
let us note i?„_i = 1 ©i?„_i the orthogonal transforma- 
tion in 0{n) acting as the identity on the first element of 
the canonical basis of R" and as Rn-i on the last n — 1 
elements of the basis. 

Then, let us draw uniformly at random a unit vector Un 
on the sphere and define the following Householder 

reflection 

Hn - K - 2unul. (F4) 

Note that drawing u„ can be done in linear time simply 
by drawing n random normal variables and normalizing 
the obtained vector. Also, applying i7„ to any vector can 
be done in linear time in n. 

Finally, one can show that random orthogonal trans- 
formation i?„ — HnRn~i follows the Haar distribution 
of 0{n) [s^l- In particular, one has: 

1 

Rn = n ^'^ (F5) 

where one defines Hk — In-fc ® Hk- 

Hence, drawing, describing and applying a random or- 
thogonal transformation from Oin) are tasks with com- 
plexity quadratic in n. We define the subset of the 
orthogonal group as corresponding to the set of compo- 
sitions of k such Householder reflections, that is the last 
k steps of the algorithm described above. For instance, 
Fi corresponds to the set of Householder reflections with 



respect to a hyperplane of M", and J^n is the orthogo- 
nal group 0{n). One can also define a family of mea- 
sures iii,fi2, ■■ ■ , fJ-n on 0{n) corresponding to the uni- 
form measures of J^i , j • ' ' i -^n ■ 

A complete symmetrization would imply performing 
orthogonal transformations on both Alice and Bob's data 
chosen randomly with the measure /^„, but for all prac- 
tical purposes, it seems that fii already provides a high 
level of symmetrization. 



Appendix G: Full protocol with the symmetrization 

step 

We present here two different schemes, depending on 
the choice of modulation which can be either fully Gaus- 
sian or consists of a non-Gaussian modulation supple- 
mented by appropriate decoy states. The former modu- 
lation is compatible with both a homodyne or a hetero- 
dyne detection and corresponds to the technique detailed 
in Appendix IC II while the latter, which is more efficient 
in terms of resources, is only compatible with a hetero- 
dyne detection (and is detailed in Appendix IC 2p . These 
schemes include the active symmetrization introduced in 
Appendix |F1 



1. Fully Gaussian modulation 

The full protocol is the following: 

• Alice draws 2n random variables xi^X2-,--- ,X2n 
from a centered normal distribution with the ap- 
propriate variance. These form a vector x G R^". 

• Ahce sends the states \ai),--- ,\ak),-' A'^n) to 
Bob, with \ak) = \x2k +ix2k+i)- 

• Bob receives the states after the quantum channel 
and measures them, with either a homodyne de- 
tection or a heterodyne detection. In the case of a 
heterodyne detection, he obtains a 2n-dimensional 
vector y. In the case of a homodyne detection, he 
obtains an n-dimensional vector y, then informs Al- 
ice about his choices of measured quadratures (x 
or p for each state); Alice only keeps the relevant 
coordinates in her data in order to form a new n- 
dimensional vector x. 

• Alice randomly draws a random orthogonal trans- 
formation R from the orthogonal group 0{2n) (or 
0(n) for a homodyne detection). In theory, to 
achieve a perfect symmetrization of the state, Alice 
should draw R with the Haar measure on 0{2n). 
However, in practice, R can be chosen uniformly 
in a well-chosen subset of 0{2n) which has the ad- 
vantage of allowing for efficient descriptions of its 
elements, such as one of the measures /ifc defined in 
Appendix |F1 
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• Alice describes R to Bob through the classical com- 
munication channel, and both parties apply R to 
their respective vector, hence obtaining x' — Rx 
and y' = Ry. 

• Alice chooses randomly npE coordinates that are 
used for parameter estimation. 

• The next step is where lies the novelty of our pro- 
tocols. For instance, in the so-called four-state 
protocol, Alice considers the coordinates x'f. which 
were not used for parameter estimation and keeps 
only the ones such that is sufficiently close to 
a predetermined value. In the case of the eight- 
dimensional protocol (with heterodyne detection 
for instance), Alice divides her data into blocks of 
size 8 and keeps the blocks for which the euclidean 
norm is close to a predetermined value (see Ap- 
pendix [UT] for details). Alice informs Bob of the 
indices that she keeps. The rest of the data are dis- 
carded. At this point, Alice and Bob have classi- 
cal correlations for which an efficient reconciliation 
protocol is available (see Appendix [B|) . 

2. Non-Gaussian modulation and decoy states 

In this scheme, the positions of the states used for pa- 
rameter estimation are chosen randomly beforehand by 
Alice. Let us consider for simplicity the case of the eight- 
dimensional protocol. 

• Alice draws n 8-dimcnsional random vectors, each 
chosen from one of the three following distributions: 
random vectors on the 7-dimensional sphere with 
the appropriate radius (these data correspond to 
the non-Gaussian modulation which will be used 
for the key distillation), random vectors on the 7- 
dimensional sphere with an appropriately fluctuat- 
ing radius (these are the decoy states which will be 
discarded at the end of the protocol: the mixture 
of these states with the previous ones should be in- 
distinguishable from a true Gaussian distribution) 



or Gaussian vectors which are used for parameter 
estimation. Alice hence obtains an 8n-dimensional 
vector X for which each subset of length 8 corre- 
sponds either to legitimate information, decoy data 
that will be discarded or data used for parameter 
estimation. 

• Alice randomly draws a random orthogonal trans- 
formation R from the orthogonal group 0(8n). In 
theory, to achieve a perfect symmetrization of the 
state, Alice should draw R with the Haar measure 
on 0{8n). However, in practice, R can be chosen 
uniformly in a well-chosen subset of 0{2n) which 
has the advantage of allowing for efficient descrip- 
tions of its elements, such as one of the measures 
/ifc defined in Appendix [Fl 

• Alice computes the vector x' = Rx, which is the im- 
age of X by the orthogonal transformation R and 
uses this vector for her modulation. Hence she 
sends the states \ai), • • • , \ak), • • • , |a4n) to Bob, 
with \ak) = 14/0 +*4fc+i)- 

• Bob receives the states after the quantum channel 
and measures them, with a heterodyne detection. 
He obtains an 8n-dimensional vector y'. 

• Alice describes R to Bob through the classical com- 
munication channel. Bob applies R^^ to his vector 
y' and obtains y = R~^y' . 

• Alice reveals which subsets of length eight should 
be kept for the key distillation, which ones should 
be discarded (as they correspond to decoy states) 
and which ones should be used for parameter esti- 
mation. 

• At this point, Alice and Bob have classical correla- 
tions for which an efficient reconciliation protocol 
is available (see Appendix [Bjl . 



